DETECTING COMPLEX MULTIPLICATION 

JEFFREY D. ACHTER 



Abstract. We give an efficient, deterministic algorithm to decide if two abelian 
varieties over a number field are isogenous. From this, we derive an algorithm 
to compute the endomorphism ring of an elliptic curve over a number field. 

In this paper, we answer two fundamental decision problems about elliptic curves 
over number fields. Specifically, we explain how to detect whether two elliptic curves 
over a number field are isogenous, and how to decide whether an elliptic curve 
has complex multiplication. These algorithms rely on Lemma ff .21 which actually 
applies to abelian varieties of any dimension, and Proposition 12. 21 respectively. 

In each case, we answer a question about a variety over a number field by ex- 
amining its reduction at finitely many primes. At this level of generality, such a 
strategy is common in algorithmic number theory. For example, a common method 
for computing modular polynomials - that is, bivariate polynomials whose roots are 
j-invariants of elliptic curves related by an isogeny of fixed degree - is to perform 
the analogous computation over various finite fields, and then to lift the result using 
the Chinese remainder theorem. In contrast, we will see that to answer the decision 
problems posed here, one need not ever lift an object to characteristic zero. 

The engine driving the machines presented here is Faltings's paper on the Mordcll 
conjecture. Milne observed in Mathematical Reviews that Faltings "seems to give an 
algorithm for deciding when two abelian varieties over a number field are isogenous." 
In this paper, we further refine the proof of 7 Theorem 5] to the point where it 
literally yields an efficient algorithm for the isogeny decision problem. 

At a crucial stage in that argument, Faltings shows that the isogeny class of X 
is determined by the action of G&\(L/K) on X[£](K), where [L : K] has effectively 
bounded degree and ramification but is difficult to compute directly. He therefore 
works with L, the compositum of all possible such extensions of K, a large but still 
finite extension of K. An appeal to the Chebotarev density theorem guarantees 

that there is a finite set of primes T of K such that { jj-^ : p € T} = Gal(L/K). 

Therefore, X and Y are isogenous if and only if the reductions X p and Yp are 
isogenous for each p G T. 

We derive an algorithm for detecting isogeny by showing that it suffices to use 
a set of primes p with absolute norm smaller than some constant B. Effective 
Chebotarev- type theorems Ej let us calculate a suitable B solely in terms of the 
degree and ramification data of L, without requiring recourse to the compositum 
L. 

Subsequently, we show how to use this result to test the hypothesis that an elliptic 
curve E has complex multiplication by a field F . Briefly, after a finite extension of 
the base field, there exists an elliptic curve E' with complex multiplication by F. 
Even without computing E' explicitly, we can use Lemma 11.21 to detect whether 
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E and E' are geometrically isogenous, and thus check whether E has complex 
multiplication by F. 

In the first section, we review literature concerning effective Chebotarev density 
theorems, and explain how to use £-adic representations to detect isogeny between 
abelian varieties. The reader may wish to skip Section 11.11 on first reading, and 
turn directly to Section IT7S1 

In the second section, we use these considerations to design algorithms for elliptic 
curves over number fields. In Section \2. II we describe an algorithm to determine 
whether two elliptic curves are isogenous. In Section [2. 21 we combine the results of 
the previous section with new results on complex multiplication to give an algorithm 
which decides whether a given elliptic curve has complex multiplication. 

Several improvements are available to improve the efficiency of these methods. 
In the interest of streamlining the exposition, these suggestions are gathered as a 
series of remarks in the final section. 

I thank Siman Wong for helpful discussions. 



As discussed above, the method of this paper is to apply effective Chebotarev 
bounds to Faltings's proof of the Tate conjecture in order to construct efficient 
algorithms; we review these results in Sections ll . II and H~2l respectively. 

1.1. Effective Chebotarev density theorems. The Galois group of a finite ex- 
tension of number fields L/K is generated by the Frobenius elements of primes of L 
lying over primes p of K. We collect here various results from the literature which 
place upper bounds on the size of the primes necessary in order for their Artin sym- 
bols to generate Gal(L/K). Throughout, we will use (GRH) to highlight bounds 
which rely on the generalized Ricmann hypothesis, and (U) to denote bounds which 
hold unconditionally. 

For an extension of fields L/K, we let Al/k denote the discriminant and Nx,/jf 
the norm map. For a prime ideal p of K, let k(p) be the residue field Ok/P and let 
p p be the characteristic of that field. 

Let S be a finite set of places of K and N a nonnegative integer. We will express 
our Chebotarev-type bounds in terms of the following quantities: 



1. Background 



A*(K, S, N) 



Ak /q |V-II^ 1/jv ) wq1 



pes 



B (LO) (K, S,N) 
B (BS) (K, S,N) 
B (G RK){K, S,N) 



70 -(log A* (K, S,N)) 2 

(4 log A* {K, S, N) + 2.5N ■ [K : Q] + 5) 2 

min{B (LO ) (K, 5, N), B (BS) (K, S, N)}. 



Let C(u) be the effective constant A\ of [H], and let 




K = q 
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Finally, let 

T (GRH )(K, S, N) := {p C K : N K/Q p < B (GKH) (K, S, N) and p g S} 
T (u) (X, S, N) := {p C K : N K/Q p < 5, N) and p S}. 

Lemma 1.1. Let K be a finite extension of Q, and let S G K be a finite set of 
prime ideals. Let L/K be a Galois extension with [L : K] < N unramified outside 
S. For any a € Gal(L/K), there exists p £ T^{K,S,N) and a prime q of L 
dividing p such that Fr q = a . If the generalized Riemann hypothesis holds, then p 
may be taken in T\gkh) {K, S, N) . 

Proof. The statement combines several different effective Chcbotarcv density theo- 
rems. For a conjugacy class C C Gal(L / K) , each gives an effective upper bound for 

the norm of the smallest prime p such that = C, computed in terms of the 

absolute discriminant of L. By ^1 Proposition 5], | A l /q| < A*(K, S, N); thus, in 
the sequel, we may replace each occurrence of | /q | in El Ej with A* (K, S 1 , N) . 
By jS] Theorem 1.1], any conjugacy class C C Gal(L/if) occurs as 



LJK\ fOT 

some p £ 7(u) (K, S, N) . Now suppose that the generalized Riemann hypothesis 
holds. Lagarias and Odlyzko prove EI that a bound of the form -B(lo) suffices, 
and Oesterle shows ^1 2.5] that the constant is at most 70. The bound -B(bs) is 
obtained by Bach and Sorenson in Theorem 5.1], again under the assumption of 
the generalized Riemann hypothesis. 

Since the Frobenius elements Fr q of all primes lying over a prime p of K form 

the conjugacy class -ttip , the result follows. 



L/K 

1.2. Abelian varieties and Galois modules. Let X/K be an abelian variety, 
and let t be a rational prime such that X has good reduction at all primes of K 
lying over L The ^-adic Tate module of X is T e (X) := lim- X[£ n ]{K); let V e (X) := 
Ti(X) ®% Q be the rational Tate module. Then Tg(X) is a Z^-representation of 
Ga\(K/K), while V?(X) is a representation of Gal(^/i^). It has long been 
known that these representations encode detailed arithmetic information about X. 

In fact, Faltings proves the Tate conjecture; the canonical map End(X) ®zZ^ — > 
E,nd(TeX) Gal ( K ) is an isomorphism. Consequently [3 Corollary 2] two abelian 
varieties are X and Y are isogenous if and only if ViX and VeY are isomorphic as 
Gal(i?/i4T)-modules. 

We denote the reduction of an abelian variety X/K at a prime of good reduction 
p by X p ; it is an abelian variety over k(p). 

The following result was proved by Serre H21 8.3] in the special case where 
dimX = dimY" — 1 and K = Q, but the the absolute constant given there is 
ineffective. 

Lemma 1.2. Let X and Y be g- dimensional abelian varieties over a number field 
K. Let S be a set of places of K containing all primes of bad reduction of X and 
Y , and let £ be a rational prime which is relatively prime to each place of S . Let 
v g (€) = |GL2 9 (Z/^)|. Then X and Y are isogenous if and only if X p and Y p are 
isogenous for all p £ T(\j^(K, S, v g (£) 2 ). If the generalized Riemann hypothesis is 
true, then X and Y are isogenous if and only if Xp and Y p are isogenous for all 
peT (GI{H) (K,S,v g (£) 2 ). 
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Proof. Our proof is closely modelled on that of Theorem 5] and |12l Theorem 
23.7]. Let T = T^grr) (K, S, v g {i) 2 ) if the generalized Riemann hypothesis is to 
be assumed, and let T = Tm\(K, S, v g (t) 2 ) otherwise. The key point is that the 
isogeny class of an abelian variety over a number field is determined by the Galois 
representation on its rational Tate module. Lemma fl. II lets us detect the isomor- 
phism class of a Galois representation using only the Frobenius elements over the 
finite set of primes T. 

Let p : Gal(K/K) — > Aut(T(X) x Aut(TgY) be the product representation. Since 
X and Y both have good reduction outside S, Gal(K / K) acts on TgX x TfY via 
some quotient Gal(E/K) with E unramified outside S. Let R be the subring of 
End(T e X) x End(T^y) generated over Z e by {p(cr) : a G Gal(E/K)}. We will show 
that R is in fact generated, again over Z^, by the actions of Fr q for primes q of E 
lying over p € T. 

By Nakayama's Lemma, it suffices to prove that these Frobenius elements, acting 
on (T t X/£) x {T t Y/£) = X[£](_K) x Y[£](K), generate (R/£) x . Now, the action of 
Gal(E/K) onX[e](K)xY[£](K) factors through Gal(L/K), where [L : K] is a finite 
Galois extension of degree at most | Aut(X[^(.fQ) x Aut(Y[e](K))\ = v g {i) 2 . By 
Lemma EU {Fr q : q|p e T} = Gal(L/K). Therefore, {p(Fr q ) : q\p £ T} generates 
R/l over Z/£, and this same set generates R over Z(. 

If Xp and Yp are isogenous for some prime of good reduction p, then |201 The- 
orem 1] V(X and V{Y are isomorphic as Gal(/i(p))-modules. The hypothesis that 
X p and Yp are isogenous for p € T implies that, for each Fr q with q|p e T, 
tr(Fr q \T e X) = tr(Fr q \T t Y). Extending Z r linearly, we have tr(a\T t X) = tr{a\T e Y) 
for each a E Gal(K / K) , so that §12.1, Proposition 3] ViX and V(Y are isomor- 
phic as Ga\(K/K )-modules. By the Tate conjecture [3 Corollary 2] X and Y are 
isogenous. □ 

2. Algorithms for elliptic curves 

2.1. Detecting isogenous elliptic curves. The isogeny class of an elliptic curve 
E over a finite field k is uniquely determined by Indeed, by [20, Theorem 1] 

the isogeny class of E is determined by its characteristic polynomial of Frobenius, 
which has the form T 2 — aT + \ k\. Since the number of points on an elliptic curve 
with such a characteristic polynomial is |«| + 1 — a, we see that two elliptic curves 
over k are isogenous if and only if they have the same number of points over k. 

Any efficient algorithm for counting points on elliptic curves over finite fields, 
such as Schoof's method which requires 0(log 9 |k|) bit operations, therefore 
yields an efficient method for deciding if two elliptic curves are isogenous. 

More generally, any efficient algorithm for computing the action of Frobenius on 
TiX for a class of abelian varieties X, such as Jacobians of hyperelliptic curves, 
can decide if two such abelian varieties are isogenous. (Note that, in dimension 
greater than one, the action of Frobenius is not uniquely determined by its trace. 
Data such as the characteristic polynomial of Frobenius, rather than just the trace 
of Frobenius, is required to detect the isogeny class of an abelian variety over k.) 

We now turn our attention to number fields. In principle, Faltings's theorem 
affords us a choice of methods for determining whether two elliptic curves E\ and 
Ei over a given number field are isogenous. For instance, Masser and Wiistholz [TT] 
use transcendence theory to give an explicit upper bound on the minimal degree of 
an isogeny between two elliptic curves. One could then try to enumerate all curves 
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related to E± by an isogeny of given degree [22]) and check if E2 is isomorphic to any 
of them. One could also simply try to see if E\ and E2 satisfy a modular equation of 
suitable degree. Each of these operations carries a nontrivial computational cost pp . 
Moreover, the best known constant appearing in such degree bounds jl31 Theoreme 
1] is larger than 10 61 ; such a method remains of theoretical, rather than practical, 
interest. 

Alternatively, an efficient algorithm follows from Lemma 1 1.21 Given two elliptic 
curves E\ and E2 over a common number field K , compute the discriminant A,; of 
Ei, and thence the set of primes Si for which Ei has bad reduction. If S\ =/= S2, 
then Ei and E2 are not isogenous |171 Corollary 2]. Otherwise, choose a rational 
prime I relatively prime to each element of S := S\ = S2. By Lemma 11.21 E\ 
and E2 are isogenous if and only if Ei jV and £?2,p are isogenous for for each p £ 
T(K, S, (£ 2 — 1) 2 (£ 2 — £) 2 ); this last condition may be checked using point-counting 
for each -E^p. (Again, if a method is available for computing the characteristic 
polynomial of Frobenius, then the same method works for detecting isogeny of 
abelian varieties of dimension g; one simply computes at all primes with norm less 
than v g (£) 2 .) 

We remark that exhibiting infinitely many primes p for which E\ tV and i?2,p are 
isogenous does not prove that E\ and E2 are isogenous. Indeed, suppose that E\ 
and E2 have complex multiplication by distinct fields F\ and F2, respectively. On 
one hand, E\ and E2 are not isogenous, since the rational ring of endomorphisms 
is an isogeny invariant. On the other hand, we will see below that E\ r p and £?2,p 
are both supersingular, and thus isogenous, for all primes p of K for which p p is 
inert in each extension F</Q. 

2.2. Detecting complex multiplication. Let E be an elliptic curve over a num- 
ber field K. The endomorphism ring End(_E) of E is isomorphic either to Z or to 
an order O in a quadratic imaginary field, F. In the latter case, we say that E has 
complex multiplication by F. (More generally, we will say that an elliptic curve 
over an arbitrary field has complex multiplication by F if its endomorphism ring 
contains an order in F.) 

Elliptic curves with complex multiplication are prominent in primality testing 
and cryptography [2] and other aspects of algorithmic number theory J5] . Motivated 
by this, one might seek an algorithm for determining whether a given elliptic curve 
E over a number field K has complex multiplication. In 0, the author describes 
two methods. The first is a probabilistic algorithm which runs in polynomial time 
in the inputs; the second runs in deterministic polynomial time, but the constants 
appearing in the analysis of the running time are ineffective. In this section, we use 
Lemmas 11.11 and II .21 to give an efficient, effective algorithm to determine whether 
an elliptic curve has complex multiplication. We start by collecting a body of 
facts about elliptic curves with complex multiplication. The subsequent algorithm 
follows naturally from these observations. 

Deuring investigated the relationship between the arithmetic of F and the re- 
ductions Ep at primes of K. (For the moment, we ignore primes of bad reduction.) 
He proved (see Exemple b]) that Ep is ordinary if and only if p p , the rational 
prime lying under p, splits in F. Invoking the Chebotarev density theorem for F, 
we see that E has ordinary reduction at half the primes of K, and supersingular 
reduction at the others. 
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Conversely, if End(i?) = Z, so that E does not have complex multiplication, 
then supcrsingular primes have density zero IV-13, Exercise 1]. This basic 
observation leads to a probabilistic method, detailed in |5j, for checking whether an 
elliptic curve has complex multiplication. Broadly speaking, finding may primes of 
supersingular reduction provides evidence for the hypothesis that E has complex 
multiplication. 

In the sequel, we will use Lemma ll.2l fand the accompanying discussion at the end 
of Sect ion |2~T|) to describe a deterministic algorithm to test whether an elliptic curve 
E has complex multiplication. By this, we mean that the algorithm is guaranteed 
to terminate after a finite, explicitly computable number of operations, and that the 
output is a verifiable proof that E does (or does not) have complex multiplication. 

It is convenient to assume that the elliptic curve of interest has no automor- 
phisms other than {±1}, and that it has good reduction everywhere. The former 
condition is equivalent to the assertion that E does not have complex multiplication 
by Q(\/ 3 T) or Q(V^3), which is easily verified by checking that j{E) £ {0, 1728}. 

The latter condition holds, possibly after a finite extension of the base field, for 
an elliptic curve with complex multiplication. (This assertion is equivalent to the 
result of Weber [TH| C.11.2.a] that an elliptic curve with complex multiplication 
has integral j-invariant.) Concretely, let N be the product of all primes of bad 
reduction of E, and let K\ = K(^/7\f). Suppose that E has complex multiplication 
by a field whose only roots of unity are 1 and —1. A special case of ^| Theorem 
7] shows that Ek x has good reduction at all places of K\. 

Henceforth, we will assume that E/K has everywhere good reduction. 

We now show that it is easy to find a prime of ordinary reduction for E, and 
thereby find a candidate ring of endomorphisms for E. 

Lemma 2.1. Let E/K be an elliptic curve over a number field with complex multi- 
plication and good reduction everywhere. Let S be the set of rational primes ramified 
in the extension <S7Q. Then there exists a prime p of K lying over a rational prime 
p with p < B(u)(Q, 5, 2) such that E has good, ordinary reduction at p. Lf the 
generalized Riemann hypothesis is true, then p may be taken less than or equal to 
-S(GRH) (Q, Sq, 2) . 

Proof. If End(E') ® Q is isomorphic to a quadratic imaginary field F, then K neces- 
sarily contains F |1L)I Theorem 3.1.1]. In particular, the support of the discriminant 
of F over Q is contained in the support of the discriminant of K over Q, so that 
F is unramificd outside S. Moreover, E has ordinary reduction at a prime p over 
the rational prime p if and only if p splits in F. The Chcbotarev density theorem 
(Lemma II .If) guarantees the existence of such a p with p < -B(u) (Q> Sq, 2). (If 
the generalized Riemann hypothesis is true, then p may be taken to be at most 
S (G rh)(Q,5q,2).) " □ 

Since supersingular primes have density zero for an elliptic curve without complex 
multiplication, it seems unlikely that one would encounter an E/K without a small 
(in the sense of Lemma 12. It ordinary prime. Still, if this were to happen, one could 
then conclude that the elliptic curve had endomorphism ring equal to Z. 

Let p be a prime of ordinary reduction of E. Then the ring Z[Fr p ] C End(_E p ) 
is isomorphic to an order in a quadratic imaginary field F. (To see this, use the 
result of Deuring |18l Theorem V.3.1], paralleling the result in characteristic zero, 
that the endomorphism ring of an ordinary elliptic curve is either Z or an order in 
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a quadratic imaginary field. Moreover, the Frobenius endomorphism cannot have a 
real conjugate j21| Exemple a], so it must actually generate a quadratic imaginary 
field.) Moreover, given the number of points on E p , one can determine the field 
F = FracZ[Fr p ]. This is a candidate field of (rational) endomorphisms of E. and 
we show in Proposition 12.21 how to test the hypothesis that E truly does have 
complex multiplication by F. (At this stage of the calculation, one knows that E 
has complex multiplication by some quadratic imaginary field if and only if it has 
complex multiplication by F.) 

It is known |181 Corollary C.ll.l] that there is a finite extension K' of K and 
an elliptic curve E' /K' with complex multiplication by F. At this point, one 
could simply compute the j-invariant of E' and check whether j(E) and j(E') are 
conjugate under Gal(Q). However, to compute the polynomial over Q which j(E') 
satisfies takes time 0(|A f /q| (log | A f /q|) 2 ) [2] (see also 7.6]). 

Now, if one could construct E' efficiently, one could use Lemma 11.21 to test 
whether E and E' are isogenous, since isogenous elliptic curves have commensurable 
rings of endomorphisms. Even without knowing E' explicitly, however, we can 
efficiently test whether the two curves are (geometrically) isogenous. 

Proposition 2.2. Suppose that E/K has good reduction everywhere. Let F be a 
quadratic imaginary subfield of K whose only roots of unity are —1 and 1, and let 
h*(F) = 2y / ApyQ/7r. Then E has complex multiplication by F if and only if for 
each prime p G K lying over a rational prime p with Np < -Bm) $j h*(F)i>2(2) ), 
either: 

• Ep is supersingular and F is inert or ramified at p, or 

• End(E'p) ® Q = F, and F is split at p. 

If the generalized Riemann hypothesis is true, then it suffices to consider those 
primes with norm at most S(grh)(^'j 0j h*(F )i/2(2) 2 ). 

Proof. If the generalized Riemann hypothesis is to be assumed, we write B for 
-S(GRH) an( i T f° r T{grh)j otherwise, these symbols denote -B(u) and 7(tj)> respec- 
tively. Note that the statement is equivalent to the assertion that E has com- 
plex multiplication by F if and only if the same is true of E p for each prime 
p S B(K,(d,h*(F)v 2 {2) 2 ). Since there is a natural inclusion End(E') End(£p) 
for each prime p ^3 Theorem 2.3.2], if E has complex multiplication by F then the 
same is true of E p for each prime p, and in particular for those in B(K, 0, h* (F)v2{2) 2 ) 

Having secured this, we focus on the converse. There exists an elliptic curve over 
a field K' with complex multiplication by F if and only if K' contains the Hilbert 
class field of F ^| Theorem C.11.2]. Moreover, since the only roots of unity in F 
are {±1}, we may assume that E' has good reduction everywhere ^| Theorem 9]. 

Therefore, let K' be the compositum of K and the Hilbert class field of F, 
and let E'/K' be an elliptic curve with everywhere good reduction and complex 
multiplication by F. The original elliptic curve E has complex multiplication by 
F if and only if Ex' and E' are isogenous over some finite extension of K 1 . (An 
analytic construction, as in C.ll], shows that E and E 1 are isogenous over 
C; this isogeny must then descend to some finite K'/K |191 Theorem II. 2. 2].) 
Equivalently, E has complex multiplication by F if and only if Ek 1 is isogenous to 
some twist of E' . 

Let N — V2{2) 2 and suppose that, for all primes q G T(K',$,N), E q has 
complex multiplication by F. Then E q and E' are isogenous up to a quadratic 
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twist, and there exists a twist E" of E' such that E q and E'J are isogenous for all 
q € T(K', 0, N). By Lemma fOl E and 2?" are isogenous, and thus E has complex 
multiplication by F. 

If the prime q of K' lies over the prime p of if, then N^/ /Q(q) < N^/q(p). In par- 
ticular, each prime q € T(if', 0, TV) lies over a prime p with N^/Qp < B(K', 0, iV). 
Moreover, E„ is the base change E p x ft(q), and thus E q has complex multipli- 
cation by F if and only if E p does. We have thus shown that E has complex 
multiplication by F if and only if the same is true for each reduction Ep with 
Nx/Qp < B(K', 0, N). Now, if' is an unramified extension of K of degree at most 
h*(F). Therefore, 



A* (if', 0, N) 



|A K ' 



i jv 



N N-[K':> 



A 



W-[if':if]^jv.[if' : K]\[Jr-.i 



= |A 

< A*(K,®,h*(F)N), 



and the result follows. 



□ 



Taken together, the results of this subsection suggest the following algorithm for 
determining whether an elliptic curve E has complex multiplication. First, check 
whether j(E) £ {0, 1728}; if so, the answer is yes; if not, one continues. Second, 
construct K{yN), and verify that E/K(^/]7) has good reduction everywhere; if 
this fails, then |17l Theorem 7] E does not have complex multiplication. Other- 
wise, replace K with K(^/Af), and use Lemma f2.ll to find a candidate field F of 
endomorphisms. Finally, Proposition 12.21 allows us to test efficiently if E/K has 
complex multiplication by F. 



3. Algorithmic considerations 

We close with some remarks which may allow more efficient implementation of 
these algorithms. 

3.1. Chebotarev density theorem. It is sometimes possible to improve the 
bounds given in Lemma 11.11 In special cases where [K : Q] and N are both 
small, 3 , Table 1] provides even tighter bounds for the norm of the smallest prime 
ideal with given Artin symbol. 

Moreover, if either the bound -B(bs) or ^(U) is used, then it suffices to consider 
those primes p of K with norm a rational prime. 

3.2. Bounds in Lemma 11.21 The term v(g) = |GL2 9 (Z/£)| arises in the proof of 
Lemma 11.21 as the size of the automorphism group of X[£]. If X further comes 
equipped with a polarization over K of degree prime to £, then the action of 
Gal(if/if) on T[X commutes with the induced symplectic pairing. Therefore, if 
one further makes the assumption in Lemma ll.2l that X and Y admit polarizations 
over K of degree relatively prime to £, then v g {£) may be replaced by |GSp 2s (Z/€)|. 
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3.3. Candidate fields of complex multiplication. In Sect ion l2~2l we suggested 
using Lemma |2.1I to find a candidate ring of endomorphisms of E. Alternatively, 
if Endif(-E) is an order in a quadratic imaginary field then End^i?) C K, so 
that End#- (E) £g> Q is a quadratic imaginary subfield of K. Therefore, one can 
enumerate each such subfield Fi of K, and apply Proposition 12.21 to each; E has 
complex multiplication by some field if and only if it has complex multiplication by 
one of the Fi. 

3.4. Bounds in Proposition 12.21 The proof of Proposition 12.21 shows that it 
suffices to consider those primes of K with norm at most, e.g., 

70- OF) log A* (if, 0, ^ 2 (2) 2 )) 2 

if the Lagarias and Odlyzko bound is to be used; the analogous improvement may be 
made in each of the other bounds, as well. Moreover, one can replace the (perhaps 
pessimistic) bound h* (F) with the actual class number of F; this class number can 

be computed in time 0(\ A f /q| 1 ^ 4+£ ), and even 0(|A f /q| 1 ^ 5+£ ) if the generalized 
Riemann hypothesis is assumed 5.4]. Finally, if one could verify that the Hilbert 
class field of F is already contained in K, then one would know (in the notation of 
the proof) that K — K' , and one could replace h*(F) with 1. However, it is not 
clear to the author how to verify this condition, short of actually computing the 
Hilbert class field. 

3.5. Detecting potential complex multiplication. It is not hard to adopt the 
observations of Section ^. 2l to test whether E potentially has complex multiplication, 
in the sense that Endf^(E) <§5 Q is a quadratic imaginary field. One needs to replace 
Lemma 12.11 with an upper bound for the size of a prime of ordinary reduction; as 
noted there, we expect in practice that it is quite easy to find such a prime. This 
generates a candidate field F of rational endomorphisms for E^. One can then 
apply Proposition 12 . 21 to check whether Ek.f has complex multiplication by F. 
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